its-consulting/Dienstplan-Pro
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(auth): Story 3.1 — /api/state pro Nutzer hinter Auth (Anti-IDOR), documents (user_id,key), Startup seed+migrate

Browse source
This commit is contained in:
Kenearos 2026-07-07 22:46:25 +02:00
parent 0b25c7b493
commit 846ca4f83a
5 changed files with 91 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

30
server/db.test.js
View file

@ -4,26 +4,34 @@ const fs = require('fs');
const os = require('os');
const path = require('path');
// DATA_DIR auf Temp umbiegen, BEVOR db.js geladen wird
process.env.DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'dp-db-'));
const { getDoc, putDoc } = require('./db');
const { getDoc, putDoc, db } = require('./db');
test('putDoc/getDoc Roundtrip', () => {
putDoc('employees', ['Max', 'Anna'], '2026-07-07T10:00:00.000Z');
const doc = getDoc('employees');
const UID = 1;
test('putDoc/getDoc Roundtrip (pro Nutzer)', () => {
putDoc(UID, 'employees', ['Max', 'Anna'], '2026-07-07T10:00:00.000Z');
const doc = getDoc(UID, 'employees');
assert.deepStrictEqual(doc.value, ['Max', 'Anna']);
assert.strictEqual(doc.updatedAt, '2026-07-07T10:00:00.000Z');
});
test('getDoc für unbekannten Key liefert null', () => {
assert.strictEqual(getDoc('gibtsnicht'), null);
assert.strictEqual(getDoc(UID, 'gibtsnicht'), null);
});
test('putDoc snapshottet den alten Wert in history', () => {
const { db } = require('./db');
putDoc('duties', { v: 1 }, '2026-07-07T10:00:00.000Z');
putDoc('duties', { v: 2 }, '2026-07-07T11:00:00.000Z');
const rows = db.prepare("SELECT value FROM history WHERE key = 'duties' ORDER BY id").all();
test('putDoc snapshottet den alten Wert in history (mit user_id)', () => {
putDoc(UID, 'duties', { v: 1 }, '2026-07-07T10:00:00.000Z');
putDoc(UID, 'duties', { v: 2 }, '2026-07-07T11:00:00.000Z');
const rows = db.prepare("SELECT value, user_id FROM history WHERE key='duties' AND user_id=? ORDER BY id").all(UID);
assert.strictEqual(rows.length, 1);
assert.deepStrictEqual(JSON.parse(rows[0].value), { v: 1 });
assert.strictEqual(rows[0].user_id, UID);
});
test('Datentrennung: verschiedene user_id → disjunkte Daten', () => {
putDoc(10, 'employees', ['A'], '2026-07-07T10:00:00.000Z');
putDoc(20, 'employees', ['B'], '2026-07-07T10:00:00.000Z');
assert.deepStrictEqual(getDoc(10, 'employees').value, ['A']);
assert.deepStrictEqual(getDoc(20, 'employees').value, ['B']);
});